You have configured the performance SLA with the probe mode as Prefer Passive. What are two observable impacts of this configuration? (Choose two.)

When an SD-WAN performance SLA is configured with the probe mode set to 'Prefer Passive', FortiGate relies on existing TCP traffic to passively measure latency, jitter, and packet loss, eliminating the overhead of active probes. Therefore, passive monitoring occurs only if TCP traffic is actively passing through the SD-WAN member. If TCP traffic ceases, FortiGate automatically switches to active monitoring (sending active probes) to ensure the link's health is still tracked. Once in active mode, FortiGate will continue active probing for a default period of 3 minutes before attempting to fall back to passive monitoring again.

A: Traffic subject to passive monitoring cannot be offloaded to hardware (NP processors) because the CPU must inspect the TCP packets to calculate SLA metrics.

B: Passive monitoring relies exclusively on TCP traffic (analyzing sequence numbers and acknowledgments to measure latency and loss), not ICMP traffic.

C: While passive monitoring relies on traffic, the system automatically switches to active monitoring when traffic stops, ensuring dead members are still detected by the SLA rule.

1. Fortinet FortiOS 7.2 Administration Guide. Section: SD-WAN > Performance SLA > Performance SLA probe modes (Passive WAN measurement).

2. Fortinet NSE 7 SD-WAN 7.2 Courseware. Module: SD-WAN Performance SLA and Health Checks.